## https://sploitus.com/exploit?id=686EE5AB-CB2C-5D66-87E3-5DC12E8D5EE2
# CVE-2023-6063 β WP Fastest Cache SQL Injection PoC
Proof of Concept (PoC) for **CVE-2023-6063**, an unauthenticated, time-based blind SQL injection vulnerability affecting **WP Fastest Cache β€ 1.2.2**.
The vulnerability can be triggered through the `wordpress_logged_in` cookie and may allow an attacker to infer sensitive information from the WordPress database, including password hashes and email addresses.
> **For authorized security testing and educational purposes only.**
---
## Features
* Time-based blind SQL injection testing.
* Character-by-character data extraction using SQL `SLEEP()` delays.
* Target a specific WordPress username.
* Optional password-hash validation.
* Optional email extraction.
* Custom cookie support.
* Configurable response delay.
* Debug mode for troubleshooting.
* Selective extraction using:
* `--just-hash`
* `--just-email`
### Data That Can Be Extracted
Depending on the target configuration and database contents, the PoC can extract:
* WordPress password hashes from `wp_users.user_pass`.
* Associated email addresses from `wp_users.user_email`.
---
## Requirements
* Python 3.x
* A target running a vulnerable version of WP Fastest Cache.
* Network connectivity to the target.
* Authorization to perform security testing.
Install the required Python dependencies:
```bash
pip install -r requirements.txt
```
---
## Usage
### Basic Usage
```bash
python3 poc.py -u https://vulnerable-website.example --username admin --delay 5
```
Replace the example URL with a system you are explicitly authorized to test.
### Command-Line Options
```text
-h, --help
Show the help message and exit.
-u URL, --url URL
Full URL of the WordPress installation to test.
--username USERNAME
Specify the WordPress username whose information should be tested.
-d DELAY, --delay DELAY
Response delay used for time-based testing.
Default: 5 seconds.
Minimum: 2 seconds.
-H HASH, --hash HASH
Hash to verify against the wp_users table.
If the hash contains special characters, wrap it in single quotes.
--domain DOMAIN
Domain used for email validation.
-c COOKIE, --cookie COOKIE
Specify a custom cookie name if the target uses a different context.
--status-code STATUS_CODE
Specify the expected positive HTTP status code.
Default: 200.
--debug
Enable additional debugging output.
--just-hash
Extract only the password hash.
--just-email
Extract only the email address.
```
---
## Technical Details
### Vulnerability Description
**CVE-2023-6063** affects WP Fastest Cache versions **β€ 1.2.2**.
The vulnerability is an **unauthenticated blind SQL injection** that can be triggered through the `wordpress_logged_in` cookie.
The issue can be abused to perform time-based inference against the WordPress database. By measuring differences in HTTP response times, individual characters of database values can potentially be inferred without directly receiving the queried data in the HTTP response.
A simplified example of the underlying technique is:
```sql
" AND (IF(
(SELECT user_pass
FROM wp_users
WHERE user_login="admin") LIKE 'a%',
SLEEP(5),
0
))-- -
```
If the tested condition evaluates to true, the database introduces a delay. Repeating this process with different characters allows information to be inferred character by character.
---
## Vulnerability Information
| Property | Details |
| --------------------- | ------------------- |
| **CVE** | CVE-2023-6063 |
| **CVSS** | 7.5 β High |
| **Vulnerability** | Blind SQL Injection |
| **Injection Type** | Time-Based |
| **Authentication** | Not required |
| **Affected Software** | WP Fastest Cache |
| **Affected Versions** | β€ 1.2.2 |
| **Attack Vector** | Remote |
---
## Attack Vector
### Exploitability
* **Remote:** The vulnerability can be triggered through HTTP requests.
* **Authentication:** No WordPress authentication is required to trigger the vulnerability.
* **Complexity:** Relatively low when the vulnerable conditions are present.
### Potential Impact
| Security Property | Impact |
| ------------------- | ------ |
| **Confidentiality** | High |
| **Integrity** | None |
| **Availability** | None |
Potentially exposed information includes WordPress user password hashes and email addresses.
---
## Demo
The following demonstration shows the PoC being used against an authorized test environment:
---
## Password Hash Analysis
When a WordPress password hash has been legitimately obtained during an authorized security assessment, password-auditing tools such as **John the Ripper** or **Hashcat** can be used to assess password strength.
For example, with John the Ripper:
```bash
john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt --format=phpass
```
Only perform password auditing against hashes you are authorized to possess and test.
---
## Affected Versions
WP Fastest Cache:
```text
β€ 1.2.2
```
---
## Mitigation
The recommended mitigation is to **upgrade WP Fastest Cache to a version that contains the security fix**.
Additional defensive measures include:
1. Keep WordPress plugins updated.
2. Remove plugins that are no longer required.
3. Deploy appropriate WAF rules to detect and block SQL injection attempts.
4. Monitor suspicious requests containing SQL syntax in HTTP cookies.
5. Review WordPress user accounts and credentials after a suspected compromise.
6. Rotate potentially exposed credentials when appropriate.
> **Recommended:** Upgrade WP Fastest Cache to **1.2.3 or later**.
---
## References
* [NIST NVD β CVE-2023-6063](https://nvd.nist.gov/vuln/detail/CVE-2023-6063)
* [WordPress Plugin β WP Fastest Cache](https://wordpress.org/plugins/wp-fastest-cache/)
* [CVE Details β CVE-2023-6063](https://www.cvedetails.com/cve/CVE-2023-6063/)
---
## Legal Disclaimer
This project is provided for **educational purposes and authorized security research only**.
Do not use this PoC against systems, websites, applications, or infrastructure without explicit permission from the owner.
The author is not responsible for misuse, damage, data loss, unauthorized access, or any other consequences resulting from the use of this software.
**Only test systems you own or have explicit authorization to assess.**
---
## License
This project is released under the **GNU General Public License v3.0 (GPLv3)**.